Device and method for identifying a user of a medical device

ABSTRACT

A medical device, with an operating element for triggering the medical device, includes a safety system for preventing an erroneous triggering of the device. The present invention encompasses a method for controlling the medical device including determining if an operating command is given by a person prior to the device&#39;s carrying out the command.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is a continuation of International Patent ApplicationNo. PCT/EP2004/005038, filed on May 11, 2004, which claims priority toGerman Application No. DE 103 25 106.5, filed on Jun. 3,2003, thecontents of both applications are incorporated in their entirety hereinby reference

BACKGROUND

The present invention relates to medical devices and methods of makingand operating or using them. In some embodiments, the invention relatesto a device and a method for detecting whether a medical device, such asan injection device, an infusion device, a device for measuring theconcentration of a specific substance, or any other medical function,delivery or measuring device, is being operated by a person. In someembodiments, the present invention relates to devices and methods foridentifying a user or operator of a medical device on the basis ofperson-specific features such as, for example, biometrics orbody-specific features, and to tying the operation or functions of amedical device to the identity of a person.

In the case of medical devices, such as injection devices, insulinpumps, or other substance delivery devices, or devices for performingmeasurements, it is often desired that the operation of such devices becarried out as unobtrusively as possible, the devices being carried, forexample, in a pocket, on a belt or other support, and/or under theclothes of a user. If a bolus, a metered injection, or a single dose ofmedicant is to be triggered “blind”, the controls, buttons or switchesrequired for triggering should be easy to feel, so that they may beidentified and actuated under clothes or when the device not visible tothe user. When certain types of switches are used, e.g., touch-pads,push-buttons, etc., it is possible for a device to be triggered randomlyand unintentionally by inadvertent actuation of the switch, for example,by contact with the belt or hand when putting on a safety belt, byinadvertent impact with an object, etc.

Furthermore, in the case of medical devices to be actuated by a switchor other user input there is the risk that persons not authorized tooperate the device, such as children or persons inexperienced inhandling the device, inadvertently or intentionally may triggerundesired actions of the device.

SUMMARY

In one embodiment of the present invention, a medical device is adaptedto determine whether a person intended to activate the device and/orwhether an anomaly or anomalous situation is present. In one preferredembodiment of the present invention, a medical device is adapted toestablish whether a person attempting to actuate the device isauthorized to do so, and/or whether a certain performance of the deviceis appropriate.

One object of the present invention is to provide a device and a methodwhich make it possible for a medical device to be operated as safely andreliably as possible.

According to some embodiments, the device of the present inventioncomprises a medical device, such as an infusion device, a pump, aninjection device, an injection pen, or a measuring device, for example.In some embodiments, the device may be used for measuring the proportionof a substance in a liquid, such as a blood sugar measuring device.Typically, the device has an operating element for triggering an actionor performing a function, such as the administration of a substance byinjection or infusion, for example in a metered dose or bolus. Thedevice of the present invention further comprises, in some embodiments,a safety system for preventing unintentional, unauthorized or erroneoustriggering of an action and/or to identify at least one person.

In general, the safety system according to the present invention mayinvolve various functional principles that may be used individually orin combination in order to establish that a person has actuated themedical device, rather than the device being erroneously actuated by anunintentional impact, for example, or by any type of anomaly present in,on or affecting the medical device. Furthermore, the safety system maybe designed in such a way that it determines whether the person who hasactuated an operating element is authorized, and may block the selectedoperation if the person does not have authorization. This may preventchildren or persons or patients who are not authorized from carring outcertain actions, like changing device settings, operating modes orparameters. Exemplary operations or functions include the dosage settingor amount of a substance to be administered, the time required betweendosage delivery, the number of doses capable of being administered, orthe identity of the persons authorized to operate the device. Suchsettings, operating modes, parameters or functions of a device and itsuse may be set or determined by an authorized physician or other healthprofessional.

According to an embodiment of the present invention, if a person isidentified, and one or more operating modes are stored as permissible oraccessable for that person, the operating mode may be enabled. Inanother embodiment, a personal treatment plan or therapy program may beimplemented upon identification of the person having an associatedpersonal treatment plan or therapy program.

According to one embodiment, the safety system may comprise a forcesensor, wherein a force acting on an operating element, such as aswitch, is sensed and measured or assessed. In this case, for example, alimit value of a force to be applied at least and/or applied at most maybe provided, so that an action is only triggered if the lower limitvalue is exceeded and/or not if the upper limit value is exceeded,whereby erroneous triggering, for example by slight impact, is avoided.Furthermore, it is possible to prescribe a time profile of a forcedistribution, with which the actual profile detected by the force sensoris compared with the force acting on the operating element. This mayprovide triggering of a desired action only when force distributionscustomary for an actuation by a finger, for example, are detected.Accordingly, “blind” dosage or bolus triggering or other operationsresulting from inadvertent slight or severe impact may be prevented.

It is possible to use a temperature sensor as the safety system or acomponent thereof. In these embodiments, the temperature of an operatingelement may be measured during the actuation of the operating element.Accordingly, the sensor may determine whether the operating element hasbeen actuated by a fingertip at body temperature, for example.

In some embodiments, an optical sensor may be used as the safety systemor a component thereof. An optical sensor may scan the surface of afinger using laser beams in order to detect whether an operating elementhas been actuated by a finger. In another example, the optical sensormay be used to identify the fingerprint of the finger used for actuatingthe operating element, so that the fingerprint may be checked todetermine if a person attempting to trigger a certain action isauthorized to do so.

In general, so-called “fingerprint” sensors may be used as the safetysystem according to the invention or as a component thereof. Suchfingerprint sensors may also be based on the measurement of a capacitivecoupling between the surface of a finger and the sensor. In thisexample, a multiplicity of relatively small capacitance measuringdevices are provided in an area on which a fingertip is to be placed, inorder to detect the profile of the fingertip and consequently thefingerprint.

In a further example of the present invention, a touch screen may beused as the safety system or a component thereof, in which the screenalso displays information concerning the operating state of the medicaldevice to be operated, parameters or operating modes to be set, and/orpatient information such as vital signs and measurement readings.

In another embodiment of the present invention, a transponder may beused as the operating element and/or the safety system or a componetthereof. The transponder may be carried by a person and brought into thevicinity of the medical device where the transponder detects whether themedical device is to be enabled for operation by the person, forexample. It may also be possible for the transponder to be implanted inthe person, so that a unique assignment of the medical device to aspecific person is ensured.

In general, the safety system according to the invention may be formedby one or more of the elements or components described above. It may bepossible to increase operating safety by using two or more of thedescribed safety components with one medical device or with a selectedfunction or functions of a medical device. This may provide a safetysystem which is required to be activated or triggered in a prescribedmanner in order to identify a user and to check their authorization.

According to some embodiments of the present invention, a safety systemmay be coupled to an operating element and may be designed and coupledsuch that, before the triggering of an action, a confirmation by anauthorized user is required. In addition, it may be possible that, afterrequesting the triggering of a certain action, an optical and/oracoustic signal is output to indicate to a user that the action to betriggered must be confirmed before the action, such as theadministration of a substance, is performed.

A combination of various safety or switching systems may be used forenergy-saving operation(s) of a medical device, a first switch or afirst safety system that uses little or no energy before actuation, suchas a toggle switch, which, after actuation, switches on at least onefurther safety system or feature, which has an increased energyconsumption in order to check the identity of a person operating themedical device. In some embodiments, the more energy-intensive safetysystem may be switched off or switch off automatically if identificationis unsuccessful and/or after a prescribed time has elapsed in order tominimize the energy consumption, and consequently, for example, increasethe lifetime of a battery provided in the medical device.

According to one embodiment, two operating elements, such as twoswitches that are attached at different positions of the medical devicemay be required to be actuated simultaneously or in a prescribedsequence. Providing two operating elements may also prevent a switchthat is inadvertently pressed, for example by impact, to trigger andadminister a dose or bolus. In particular, arranging operating elementson two sides of a medical device may prevent simultaneous exposure to anunintended action, force, or impact.

According to one embodiment, the safety system of the present inventionmay be capable of identifying at least one person. This may take place,for example, by the detection of one or more biometric person-specificfeatures. A database storing patterns or information related tobiometric data of individual persons may be provided in the medicaldevice or separately from the device.

According to certain embodiments, the medical device is capable ofaccessing a database via a suitable interface, such as a cable, radio,wireless, or infrared transmission, in order to have comparison orreference data available for comparison with the biometric data actuallydetected. This makes it possible for one or more persons to beunequivocally identified and to establish whether a person identified isauthorized to carry out a desired action, or whether the performance ofthe action is blocked. In one example, biometric data, such as afingerprint or a retinal pattern of a physician or other healthprofessional authorized to set parameters of the medical device may beprovided in such a database, so that only an authorized person may setthe dose of a substance to be administered from the medical device.Certain actions may not be performed, or may only be partly performed byother persons not stored in the database or stored in the database andprovided with a different access authorization. In some instances, itmay also be possible that certain functions may be performed by allpersons without identifying these persons or checking theirauthorization. In such a database, data serving for the identificationof one or more persons may also be assigned specific authorizationlevels.

In the case of one or more sensors provided as a safety system, guidesor aligning elements may be provided for aligning a person'sidentification objects with the device. This provides the device withthe capability to obtain comparable data in the case of variousmeasurements. For example, a guide for a finger may be provided, so thata fingertip to be placed on a sensor is always aligned approximately inthe same way when it is placed on the sensor. This allows the speed ofdetection of the sensor to be increased, since additional computing timedoes not have to be used to check whether a detected fingerprintcoincides with a reference fingerprint stored in a database if it isturned.

In some embodiments of the present invention, an optical and/or acousticoutput device, such as an LED or a loudspeaker, may be provided, inorder to indicate the operating state of the medical device or to drawattention to commands to be input.

In general, a safety system in accordance with the present invention maybe provided in, at or in association with a medical device. It is alsopossible to provide a separate safety device or system, which may beoperably coupled to the medical device and may serve for the detectionof identification features, such as biometric data. In this case, theseparate device may be coupled to the medical device by suitable means,e.g., cable, radio or infrared signals, or other types of wired orwireless transmissions, in order to transmit identification data or datafor setting or operating the medical device. Similarly, data may also betransmitted from the medical device to the separate device, such as dataconcerning a current operating state or recorded data which specify theoperation of the medical device over a prescribed period of time.

According to a further aspect of the present invention, the inventionrelates to a method for actuating a medical device, such as fortriggering the administration of a substance and/or for carrying out ameasurement, wherein a checking or identification method is performed.The checking or identification method is carried out to, for example,identify whether a person operating the medical device is actuallyauthorized to carry out the desired operating action or to detectwhether a person has triggered an operating action or whether theoperating action was triggered inadvertently by an unitended event orimpact, the performance of the action then not being commenced.

According to another embodiment of the invention, a medical devicecomprises an adjustable operating element configured to receive signalsto deliver a therapeutic action and to carry out the therapeutic actioncorresponding to the signals received, and a safety system for receivingperson-specific authorization signals for adjusting and/or enabling theoperating element and/or for preventing erroneous adjustment and/oractivation of the operating element. The medical device may be furtherconfigured to establish whether a person is actuating the operatingelement, and may be configured to identify whether the user is, forexample, a health-care professional or non-health-care professional.

In some embodiments, the safety system associated with the medicaldevice may be configured to include at least one of a force sensor, atemperature sensor, an optical sensor, a capacitive sensor, afingerprint sensor, a touch screen and/or a transponder, and may becapable of identifying persons operating the device. The safety systemmay also be configured to receive a confirmation signal from anidentified person that the operating element is to deliver a therapeuticaction.

A medical device in accordance with the present invention may furthercomprise a database in which information such as information for theidentification of at least one person and/or for the authorization levelof an identified person is stored. A suitable processor and/orcontroller may be integrated or associated with the device as well.

An alignment device may also be included in the medical device and maybe used to ensure that a biometric feature is detected with a body partin a prescribed positional relationship with respect to a sensor. Inaddition, or alternatively, the medical device may include an opticaland/or acoustic output device for outputting an operating state of thedevice.

In some embodiments, a medical device in accordance with the presentinvention may further include a confirmation system or feature foruser-confirmation of the intent to deliver the therapeutic action viathe medical device. The confirmation feature may be required to receivetwo or more confirmation signals, where at least two of the confirmationsignals are received from separate input locations on the medicaldevice. The input locations may be medical device operating elements,may be required to receive the confirmation signals simultaneously,and/or may be required to be separated in a way that a user is unable tosignal the input locations using a single finger or touch.

According to some embodiments of the present invention, the medicaldevice in accordance with the present invention is configured as apersonal medical device.

In another embodiment of the present invention, a safety system for usewith a medical device includes a medical device operating element, and asafety mechanism associated with the medical device operating elementfor preventing erroneous actuation of the medical device operatingelement. The safety system may include an identification device forreceiving user-specific identification data, and a securing mechanismproviding a two or more securing levels, in which each of the two ormore securing levels is releasable in response to receivinguser-specific authorization data associated with one or more of the twoor more securing levels, release of one or more of the securing levelsproviding a secure level of operation of the medical device operatingelement. According to a further embodiment, the identification devicestores user-specific authorization data having associated user-specificidentification data, processes and/or correlates received user-specificidentification data with said stored user-specific authorization datahaving user-specific identification data, and sends said user-specificauthorization data to said securing mechanism upon selected correlationof said received and stored user-specific identification data.

The present invention comprises a method for activating a medical devicewherein, before an input command is carried out, the input command ischecked to verify that the command was input by a person, and is checkedto determine that the input command has been confirmed by the person. Afurther check may be performed to determine whether the identifiedperson has a previously defined authorization. An activation command,according to one aspect medical device activation method, may beprevented from being input before a check is performed on the inputcommand or the person operating the system. In addition, the system maycarry out a person-specific program based on an identified person.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic representation of an embodiment of the presentinvention;

FIG. 2 is a flow diagram depicting operation of one embodiment of amethod according to the present invention; and

FIG. 3 is a flow diagram depicting operation of another embodiment of amethod according to the present invention.

DETAILED DESCRIPTION OF THE DRAWINGS

With regard to fastening, mounting, attaching or connecting thecomponents of devices of the present invention, unless specificallydescribed as otherwise, conventional fasteners such as screws, rivets,toggles, pins and the like may be used. Other fastening or attachmentmeans appropriate for connecting components include friction fitting,adhesives, welding and soldering, the latter particularly with regard toelectrical or processing components or systems of the devices. Anysuitable electronic, electrical, communication, computer or processingcomponents may be used, including any suitable electrical components andcircuitry, wires, wireless components, sensors, chips, boards,micro-processing or control system components, software, firmware,hardware, etc.

FIG. 1 schematically shows an embodiment of an exemplary deviceaccording to the present invention, in this instance an insulin pump 1,which includes pump electronics 5, a suitable switch 2 (e.g. touch pad,push button, etc.) for operating the pump 1, and a force sensor 3 forpreventing “blind” dosing or bolus triggering of the insulin pump 1. Theswitch 2 is operably coupled to the force sensor 3 in such a way that apressure or a force acting on the switch 2 may be detected and may becompared with a prescribed force or a pressure profile after aconversion of the signals detected in analog form in the A/D converter 4in the pump electronics 5. Consequently, inadvertent actuation of theswitch, for example by unintended impact, may be detected, since in sucha case the force typical for normal actuation or actuation by a fingeris not present at the force sensor, i.e., does not coincide with aprescribed value or profile. Any suitable actuation characteristics maybe involved, for example, a force distribution that is characteristic ofmanual actuation, a time profile of the force or pressure acting on theforce sensor 3, etc. Prescribed values and/or profiles, may be stored,for example, in the pump electronics 5 or operatively associatedtherewith, so that the erroneous triggering of a bolus or dose may bedetected and prevented.

FIG. 2 is a diagram of the components and operation or operational flowof one embodiment of the present invention. It depicts a method forchecking the authorization of an operator of a medical device, such as apump for moving, dispensing or administering medical substances, e.g.,insulin. In the embodiment shown, the checking of the authorization orauthorization status of a user is carried out separately from themedical device by means of a suitable device, such as a PC with asensor.

A sensor detects image data 1 of a user, in particular data suitable forthe identification of a person, such as the structure of the retina, afingerprint and/or any other suitable biometric features. Characteristicdetails 2, which also may be referred to as “minutiae”, are read outfrom the detected image data, it being possible to detect characteristicpatterns or features by means of an algorithm. Subsequently, a search orquery 3 is carried out in a user database 4, in which correspondingfeatures of authorized persons have previously been stored, to ascertainwhether the features determined by the algorithm coincide with thefeatures stored in the database. Correspondence is determined bycomparing 5 the input data and the stored data, and the information isused to determine whether the user is authorized 6. If the user isauthorized 8, the person operating the device is recognized from theimage data detected by the sensor and authorization information may bemade available, defining whether or not certain actions may be carriedout by this person. If the user is not authroized 7, the device outputsan error message 9.

On the basis of this authorization information, it may be determined,for example, whether an input command is to be performed and, in thecase of absent authorization, an error message may be output. If theperson identified in this way is authorized to input the correspondingcommand, it may optionally be determined in a further step 10 whetherthe person identified is, for example, a physician 11 or a patient 12.So, for example, in the case of identification of a physician 11 who isentitled to input all commands, the command may be passed on directly tothe pump 16 coupled to the PC.

If it is established that the PC was operated by a patient 12, it may bechecked in a further step whether or not an allocation provided for thepatient has already been used 13. If so 15, an error message 17 may beoutput, whereby, for example, patients may be prevented fromadministering too much painkiller to themselves. If the allocation hasnot yet been used 14, the patient is authorized to input thecorresponding command, for example to trigger the administration of aspecific dose of a substance by the pump, and the command may betransmitted to the pump 16.

In the pump 18 itself, the command 19 received may either be performeddirectly or a further check of the command input externally or directlyinto the pump may be carried out in the pump. So, for example, it ispossible that whether or not a patient's allocation has already beenused 20 may be checked again by or in the pump, and, dependent on thischeck, either an error message 24 is output when the allocation has beenused 22 or the command 25 is performed. The allocation available to thepatient reduced or decremented 23 by the dose given when the allocationhas not been used 21 may be output or displayed, too.

It is also possible for information to be transmitted from the pump tothe PC or other data storage device concerning the amount of substancegiven, allowing the PC or other data storage device to have data relatedto deliveries or infusions triggered directly at the pump.

Thus, it is possible to minimize the chances of administering anoverdose and reduce the possibility of inadvertent operation of themedical device, for example by children or by accident. Reducing thechance of overdosage may be of interest when the device is being used toadminister, for example, various pain reducing medications.

FIG. 3 shows a flow diagram of another embodiment of a method andcomponents according to the present invention wherein an electronicidentification device or electronic key is used to check theauthorization of a person to operate a medical device, such as a pump.

A user inputs a command 1 into the medical device or into a device orperipheral which is operably coupled or may be coupled to the medicaldevice and is recognized. The vehicle for inputting information may be,for example, a fingerprint or any other suitable biometric data, anenabling code and/or an electronic key. In one example, one electronickey per pump is provided, so that the pump only accepts the commandssent from the electronic key that is provided with a correspondingserial number or other correlative signal. A determination is madewhether the pump is enabled 2. When the pump is enabled 4, and onceidentification and authorization checking of the user has taken place,the pump may operated 11 normally without further authorization checksbeing required.

Optionally, a time restriction on the authorization to input commandsmay be provided, so that inadvertent enabling of a pump is automaticallyended after the prescribed time. In an instance where the pump is notenabled 3, input authorization 5 is checked 8, and if the user isauthorized 9, the pump inputs (e.g., buttons, etc.) are enabled 10.Alternatively, if the user is not authorized 7, an error message 6 isoutput. Furthermore, it is possible to actively or positively end theacceptance of commands input to the pump, so that, once the pump hasbeen operated 11 by an authorized person, a safety mechanism 12 isinitiated and further inputs to the pump may be prevented or disabled14.

Consequently, the pump may be safeguarded, for example, againstactuation by children or unauthorized users. Furthermore, it is alsopossible for a pump to be enabled without a safeguard or safetymechanism 13 by a user for use in an office, for example, and thesafeguard to be switched on for use at home, for example to protectagainst unintentional activation by children.

Some embodiments of the present invention may include an authorizationthat allows all possible actions to be carried out, for example, in theform of a so-called “master key”, which is made available to physicians,health professionals, or other persons, so that any pump or other devicefunction or operational characteristic may be assessed, enabled or setby a physician.

Embodiments of the present invention, including preferred embodiments,have been presented for the purpose of illustration and description.They are not intended to be exhaustive or to limit the invention to theprecise forms or steps disclosed. The embodiments were chosen anddescribed to provide the best illustration of the invention and itspractical application, and to enable one of ordinary skill in the art toutilize the invention in various embodiments and with variousmodifications as are suited to the particular use contemplated. All suchmodifications and variations are within the scope of the invention asdetermined by the appended claims when interpreted in accordance withthe breadth they are fairly, legally, and equitably entitled.

1. A medical device comprising an operating element for triggering anaction of the medical device and a safety system for preventingerroneous activation of the device.
 2. The device as claimed in claim 1,wherein the safety system operates to establish whether a person isactuating the operating element.
 3. The device as claimed in claim 1,wherein the safety system comprises at least one of a force sensor, atemperature sensor, an optical sensor, a capacitive sensor, afingerprint sensor, a touch screen and a transponder.
 4. The device asclaimed in claim 1, wherein the safety system is able to identify atleast one person.
 5. The device as claimed in claim 1, furthercomprising a database in which information for at least one of theidentification of at least one person and for the authorization level ofan identified person is stored.
 6. The device as claimed in claim 1,further comprising an alignment device, which ensures that a biometricfeature of a user of the device is detected with a body part of the userin a prescribed positional relationship with respect to a sensor.
 7. Thedevice as claimed in claim 1, further comprising at least one of anoptical and acoustic output device for communicating the operating stateof the device.
 8. A safety system for use with a medical device, thedevice operably coupled to the safety system to prevent erroneousactuation of the device.
 9. A method for activating a medical device,wherein before an input command is carried out, it is determined whetherthe command was input by a person and the person is identified.
 10. Themethod as claimed in claim 9, wherein whether the person has apreviously defined authorization is determined.
 11. The method asclaimed in claim 9, wherein an activation command for a system forchecking an input command or a person has to be input before theactivation of the system.
 12. The method as claimed in claim 9, whereinafter identification of a person a specific program for the person iscarried out.
 13. A medical device comprising: an adjustable operatingelement configured to receive signals causing the element to deliver atherapeutic action, and to carry out the therapeutic actioncorresponding to the signals received; and a safety system for receivingperson-specific authorization signals for at least one of adjusting theoperating element, enabling the operating element, preventing erroneousadjustment of the operating element, and activating the operatingelement.
 14. The device as claimed in claim 13, wherein the safetysystem is able to establish whether a person is actuating the operatingelement.
 15. The device as claimed in claim 13, wherein the safetysystem comprises at least one of a force sensor, a temperature sensor,an optical sensor, a capacitive sensor, a fingerprint sensor, a touchscreen and a transponder.
 16. The device as claimed in claim 13, whereinthe safety system is able to identify at least one person.
 17. Thedevice as claimed in claim 16, wherein the safety system is configuredto receive a confirmation signal from the identified at least one personthat the operating element is to deliver the therapeutic action.
 18. Thedevice as claimed in claim 13, further comprising a database in whichinformation for at least one of the identification of at least oneperson and for the authorization level of an identified person isstored.
 19. The device as claimed in claim 13, further comprising analignment device, which ensures that a biometric feature is detectedwith a body part in a prescribed positional relationship with respect toa sensor.
 20. The device as claimed in claim 13, further comprising atleast one of an optical and an acoustic output device for communicatingthe operating state of the device.
 21. The device as claimed in claim13, wherein the medical device comprises a personal medical device. 22.The device as claimed in claim 13, further comprising a confirmationsystem for user-confirmation of the delivery of the therapeutic actioncorresponding to the signals received.
 23. The device as claimed inclaim 22, wherein said confirmation system requires the receipt of twoor more confirmation signals, wherein at least two of said confirmationsignals are received from separate input locations on said medicaldevice.
 24. The device as claimed in claim 22, wherein said inputlocations comprise said operating elements.
 25. The device as claimed inclaim 23, wherein said confirmation signals are required to be input atsaid two or more input locations simultaneously.
 26. The device asclaimed in claim 25, wherein said input locations are separated suchthat said input locations are unable to be operated using a singlefinger.
 27. The device as claimed in claim 13, wherein the safety systemis able to identify whether the user is a health professional ornon-health professional.
 28. A safety system for use with a medicaldevice comprising: a medical device operating element; and a safetymechanism associated with said medical device operating element forpreventing erroneous actuation of said medical device operating element;wherein said safety mechanism comprises: an identification device forreceiving user-specific identification data; and a securing mechanismproviding a plurality of securing levels, wherein each of said pluralityof securing levels is releasable in response to receiving user-specificauthorization data associated with one or more of said plurality ofsecuring levels, release of said one or more of said securing levelsproviding a secure level of operation of said medical device operatingelement.
 29. The safety system of claim 28, wherein the identificationdevice: stores user-specific authorization data having associateduser-specific identification data; correlates received user-specificidentification data with said stored user-specific authorization datahaving user-specific identification data; and sends said user-specificauthorization data to said securing mechanism upon correlation of saidreceived and stored user-specific identification data.
 30. A method foractivating a medical device, wherein before an input command is carriedout, said input command is checked by the device to verify the commandwas input by a person and to determine that the input command has beenconfirmed by the person.
 31. The method as claimed in claim 30, whereinwhether the person has a previously defined authorization is checked bythe device.
 32. The method as claimed in claim 30, wherein an activationcommand for a system for checking an input command or a person has to beinput before the activation of the device.
 33. The method as claimed inclaim 30, further comprising identifying said person and carrying out anassociated person-specific program.